How To Erase Your Tracks Online

Chrome’s launch on Tuesday confirmed a new feature as a must-have in Web-browsing software: a cloak of invisibility that hides the user’s path around the Web. Incognito browsing, like a similar setting in a new version of Internet Explorer released last week, is designed to erase any trace of the sites you’ve recently visited, wiping away cached pages and browsing history from your hard drive and turning off the browser’s autocomplete function, which can reveal what you’ve recently typed into text boxes.

That private mode can be used for hiding indiscretions in the Web’s red-light district, or, as Google
innocently suggests, for planning “surprises like gifts or birthdays.”

But such privacy features have an increasingly more important purpose than hiding your tracks from snooping family members. Google’s and Microsoft’s
new browsing modes don’t just wipe incriminating data from a user’s hard drive; they offer features that shield users from the Web’s ever-more-aggressive behavioral data-gathering by advertisers.

Increased tracking of user behavior online for targeting ads–the subject of a Senate Commerce Committee hearing last July–is one factor driving demand for that privacy cloak, says the Center for Democracy and Technology’s Ari Schwartz. And those demands may open a new front in the browser war. “Competition in this space is clearly growing,” Schwartz says. “As it plays out, it’s a very good thing for user privacy.”

But browsers have yet to agree on just what “privacy” means. Apple’s
Safari’s “Private Browsing”–pioneered in 2005–is decidedly designed for hiding your tracks from your spouse, not the Web companies collecting data on your online activities. “Private Browsing” doesn’t block cookies–unique identifier files downloaded by your browser that Web sites and advertisers use to follow you from one site visit to the next. To block or delete cookies, users have to toggle those options or manually delete them in another menu.

Google’s slick new browser takes an important step beyond Safari in making stealth browsing easier: When a user opens an “Incognito” tab in Chrome, it not only stops recording history and the words entered into text fields, but also stores all newly-acquired cookies in a temporary folder. As soon as that Incognito tab is closed, its cookies are deleted. That means someone using Google’s stealth setting can navigate some normal sites in one tab with all of his or her identifying cookies intact, while simultaneously browsing another set of sites in stealth.

Despite the cookie-killing feature, Google offers no assurances that “Incognito” hides users from advertiser tracking, which could theoretically use tactics other than cookies–the Center for Democracy and Technology, for instance, has observed sites using IP addresses and even downloaded Adobe Flash files to track users. “Incognito is designed to hide your browsing from your computer, not hide it from the Web,” says Google engineer Sundar Pichai.

Microsoft’s latest version of Internet Explorer has bigger ambitions. IE8 offers both InPrivate Browsing, intended to clean up traces of a user’s path from his or her own computer, and InPrivate Blocking, which boasts that it hides the user’s behavior from all Web sites that track user identities.

Microsoft’s General Manager of Internet Explorer Dean Hachamovitch argues that any element of a site–be it a cookie, an ad or a video–that doesn’t come directly from a known site can be used for tracking a user’s path around the Web. Once that “third party” object is downloaded to the user’s browser, sites can check the user’s machine for that file at other visits in his or her Web session. So InPrivate Blocking lets users block all content from third parties or even choose a list of domains whose objects they wish to block.

The result, says Marc Rotenberg, director of the Electronic Privacy Information Center, is the best option for users who want anonymity from advertisers online. “Microsoft is really leading the pack on this issue,” he says.

On the more basic concern of cleaning up browsing evidence on a user’s own machine, however, Internet Explorer may have missed a more straightforward problem, says Christiane Pickaert, a researcher with Netherlands-based security firm Fox IT. Images and other page elements are still cached in Explorer’s temporary Internet files, allowing him to reassemble a user’s browsing path piece by piece. In Pickaert’s tests, he says, Chrome didn’t suffer from the same flaw.

But given all those complications and ambiguities in browsers’ privacy settings, the best solution may be a browser with no built-in privacy functions at all: Firefox. Instead of offering its own stealth feature, Firefox allows users to add whatever privacy plug-ins have been created by its open-source developer base. An add-on called Distrust works much like Safari’s Private Browsing, erasing browsing evidence from a user’s computer. Another, called Adblock Plus, nixes all the ads on a page, along with any cookies they try to send. And a third, CookieSafe, allows users to block any object from specific domains, just as Microsoft’s InPrivate Blocking does.

Microsoft’s Hachamovitch argues that the average user won’t bother with all those plug-ins. “When people get a browser, are they do-it-yourselfers or do they want it to just work?” He asks. “IE8 just works out of the box. It’s real protection for real people.”

Then again, installing a few plug-ins may be the price users pay for complete anonymity online. And when it comes to the secretive side of Web browsing, even so-called “real people” are known to do very strange things.